How to Test HubSpot Webhooks

What HubSpot Sends

HubSpot webhooks are configured at the app level (Private Apps or Public Apps). Like SendGrid, HubSpot batches multiple events into a single POST as a JSON array. Each object in the array represents one CRM event. High-traffic portals can send large batches — always iterate over the array rather than assuming a single event.

Step 1 — Generate a Requex Endpoint

Open requex.me. Your unique URL is ready immediately:

https://requex.me/hook/a1b2c3d4-e5f6-7890-abcd-ef1234567890

Copy this URL. You will paste it into HubSpot's webhook target URL field in the next step.

Step 2 — Configure HubSpot Webhook

1. In HubSpot, go to Settings → Integrations → Private Apps and open (or create) a Private App.
2. Click the Webhooks tab inside your Private App settings.
3. Set the Target URL to your Requex URL.
4. Click Create Subscription and choose the object type (Contacts, Deals, Companies) and the event type (Creation, Property Change, Deletion, or Association Change).
5. For propertyChange subscriptions, specify which property to watch or select "Any property".
6. Click Subscribe. HubSpot does not send an initial verification request — events will start flowing as soon as you trigger CRM actions.

Step 3 — Trigger a Test Event

The quickest test is to create a new contact directly in HubSpot. Go to CRM → Contacts → Create contact, fill in a name and email, and save. Within a few seconds the contact.creation event should appear in your Requex dashboard.

To test property changes, edit an existing contact's phone number or lifecycle stage. HubSpot fires a separate event for each property that changes — you may see multiple objects in a single batch if several properties are updated at once.

Step 4 — Inspect the Payload

Switch back to Requex and click the incoming request. The body is a JSON array:

[
  {
    "eventId": 1234567890,
    "subscriptionId": 987654,
    "portalId": 11223344,
    "appId": 445566,
    "occurredAt": 1712345678901,
    "subscriptionType": "contact.creation",
    "attemptNumber": 0,
    "objectId": 51234,
    "changeFlag": "CREATED",
    "changeSource": "CRM_UI",
    "sourceId": "user_id:1234"
  }
]

Notice that HubSpot only sends the object ID (objectId), not the full contact or deal record. Your handler needs to call the HubSpot CRM API to fetch the object details. For propertyChange events, the payload also includes propertyName and propertyValue.

Check the Headers tab in Requex for the X-HubSpot-Signature header — you will need this value to test your signature verification.

HubSpot Signature Verification

HubSpot supports two signature versions. The version is indicated by the X-HubSpot-Signature-Version header.

const crypto = require('crypto');
const hash = crypto
  .createHash('sha256')
  .update(APP_SECRET + rawBody)
  .digest('hex');
// Compare with X-HubSpot-Signature header

const message = method + requestUri + rawBody + timestamp;
const hmac = crypto
  .createHmac('sha256', APP_SECRET)
  .update(message)
  .digest('base64');
// Compare with X-HubSpot-Signature-v3 header

Use Requex to capture a real signed request and test both versions locally using the exact body and headers you see in the dashboard.

Common Issues